Skip to content

Commit e97f977

Browse files
MathiasVPMathiasVP
committed
C++: Add tests and accept test changes.
1 parent 2644d03 commit e97f977

2 files changed

Lines changed: 122 additions & 0 deletions

File tree

‎cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.c‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,3 +59,70 @@ int main(int argc, char **argv) {
5959

6060
return 0;
6161
}
62+
63+
typedef void *va_list;
64+
typedef void *_locale_t;
65+
66+
int vprintf(const char *format, va_list argptr);
67+
int _vprintf_l(const char *format, _locale_t locale, va_list argptr);
68+
69+
int vfprintf(FILE *stream, const char *format, va_list argptr);
70+
int _vfprintf_l(FILE *stream, const char *format, _locale_t locale, va_list argptr);
71+
72+
int vsnprintf(char *buffer, size_t count, const char *format, va_list argptr);
73+
int _vsnprintf(char *buffer, size_t count, const char *format, va_list argptr);
74+
int _vsnprintf_l(char *buffer, size_t count, const char *format, _locale_t locale, va_list argptr);
75+
76+
int vsnprintf_s(
77+
char *buffer, size_t sizeOfBuffer, size_t count, const char *format, va_list argptr
78+
);
79+
int _vsnprintf_s(
80+
char *buffer, size_t sizeOfBuffer, size_t count, const char *format, va_list argptr
81+
);
82+
int _vsnprintf_s_l(
83+
char *buffer, size_t sizeOfBuffer, size_t count, const char *format, _locale_t locale,
84+
va_list argptr
85+
);
86+
87+
int vsprintf(char *buffer, const char *format, va_list argptr);
88+
int _vsprintf_l(char *buffer, const char *format, _locale_t locale, va_list argptr);
89+
90+
int _vsprintf_p(char *buffer, size_t sizeInBytes, const char *format, va_list argptr);
91+
int _vsprintf_p_l(
92+
char *buffer, size_t sizeInBytes, const char *format, _locale_t locale, va_list argptr
93+
);
94+
95+
int vsprintf_s(char *buffer, size_t numberOfElements, const char *format, va_list argptr);
96+
int _vsprintf_s_l(
97+
char *buffer, size_t numberOfElements, const char *format, _locale_t locale, va_list argptr
98+
);
99+
100+
int _vscprintf_p(const char *format, va_list argptr);
101+
int _vscprintf_p_l(const char *format, _locale_t locale, va_list argptr);
102+
103+
void test() {
104+
// BAD: User input flowing to various printf-like functions.
105+
char fmt[1024];
106+
char out[1024];
107+
va_list args = 0;
108+
_locale_t locale = 0;
109+
fread(fmt, sizeof(char), 1024, f);
110+
vprintf(fmt, args); // BAD
111+
_vprintf_l(fmt, locale, args); // BAD
112+
vfprintf(f, fmt, args); // BAD
113+
_vfprintf_l(f, fmt, locale, args); // BAD
114+
vsnprintf(out, 1024, fmt, args); // BAD
115+
_vsnprintf(out, 1024, fmt, args); // BAD
116+
_vsnprintf_l(out, 1024, fmt, locale, args); // BAD
117+
vsnprintf_s(out, 1024, 1024, fmt, args); // BAD
118+
_vsnprintf_s(out, 1024, 1024, fmt, args); // BAD
119+
_vsnprintf_s_l(out, 1024, 1024, fmt, locale, args); // BAD
120+
vsprintf(out, fmt, args); // BAD
121+
_vsprintf_l(out, fmt, locale, args); // BAD
122+
_vsprintf_p(out, 1024, fmt, args); // BAD
123+
_vsprintf_p_l(out, 1024, fmt, locale, args); // BAD
124+
vsprintf_s(out, 1024, fmt, args); // BAD
125+
_vsprintf_s_l(out, 1024, fmt, locale, args); // BAD
126+
_vscprintf_p(fmt, args); // BAD
127+
_vscprintf_p_l(fmt, locale, args); // BAD
128+
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.expected‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,24 @@ edges
1111
| funcsLocal.c:52:2:52:16 | *... = ... | funcsLocal.c:53:9:53:11 | ** ... | provenance | |
1212
| funcsLocal.c:52:8:52:11 | *call to gets | funcsLocal.c:52:2:52:16 | *... = ... | provenance | |
1313
| funcsLocal.c:57:2:57:14 | ... = ... | funcsLocal.c:58:9:58:10 | *e1 | provenance | |
14+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:110:10:110:12 | *fmt | provenance | |
15+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:111:13:111:15 | *fmt | provenance | |
16+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:112:14:112:16 | *fmt | provenance | |
17+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:113:17:113:19 | *fmt | provenance | |
18+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:114:23:114:25 | *fmt | provenance | |
19+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:115:24:115:26 | *fmt | provenance | |
20+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:116:26:116:28 | *fmt | provenance | |
21+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:117:31:117:33 | *fmt | provenance | |
22+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:118:32:118:34 | *fmt | provenance | |
23+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:119:34:119:36 | *fmt | provenance | |
24+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:120:16:120:18 | *fmt | provenance | |
25+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:121:19:121:21 | *fmt | provenance | |
26+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:122:25:122:27 | *fmt | provenance | |
27+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:123:27:123:29 | *fmt | provenance | |
28+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:124:24:124:26 | *fmt | provenance | |
29+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:125:27:125:29 | *fmt | provenance | |
30+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:126:15:126:17 | *fmt | provenance | |
31+
| funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:127:17:127:19 | *fmt | provenance | |
1432
nodes
1533
| funcsLocal.c:16:8:16:9 | fread output argument | semmle.label | fread output argument |
1634
| funcsLocal.c:17:9:17:10 | *i1 | semmle.label | *i1 |
@@ -31,6 +49,25 @@ nodes
3149
| funcsLocal.c:53:9:53:11 | ** ... | semmle.label | ** ... |
3250
| funcsLocal.c:57:2:57:14 | ... = ... | semmle.label | ... = ... |
3351
| funcsLocal.c:58:9:58:10 | *e1 | semmle.label | *e1 |
52+
| funcsLocal.c:109:8:109:10 | fread output argument | semmle.label | fread output argument |
53+
| funcsLocal.c:110:10:110:12 | *fmt | semmle.label | *fmt |
54+
| funcsLocal.c:111:13:111:15 | *fmt | semmle.label | *fmt |
55+
| funcsLocal.c:112:14:112:16 | *fmt | semmle.label | *fmt |
56+
| funcsLocal.c:113:17:113:19 | *fmt | semmle.label | *fmt |
57+
| funcsLocal.c:114:23:114:25 | *fmt | semmle.label | *fmt |
58+
| funcsLocal.c:115:24:115:26 | *fmt | semmle.label | *fmt |
59+
| funcsLocal.c:116:26:116:28 | *fmt | semmle.label | *fmt |
60+
| funcsLocal.c:117:31:117:33 | *fmt | semmle.label | *fmt |
61+
| funcsLocal.c:118:32:118:34 | *fmt | semmle.label | *fmt |
62+
| funcsLocal.c:119:34:119:36 | *fmt | semmle.label | *fmt |
63+
| funcsLocal.c:120:16:120:18 | *fmt | semmle.label | *fmt |
64+
| funcsLocal.c:121:19:121:21 | *fmt | semmle.label | *fmt |
65+
| funcsLocal.c:122:25:122:27 | *fmt | semmle.label | *fmt |
66+
| funcsLocal.c:123:27:123:29 | *fmt | semmle.label | *fmt |
67+
| funcsLocal.c:124:24:124:26 | *fmt | semmle.label | *fmt |
68+
| funcsLocal.c:125:27:125:29 | *fmt | semmle.label | *fmt |
69+
| funcsLocal.c:126:15:126:17 | *fmt | semmle.label | *fmt |
70+
| funcsLocal.c:127:17:127:19 | *fmt | semmle.label | *fmt |
3471
subpaths
3572
#select
3673
| funcsLocal.c:17:9:17:10 | *i1 | funcsLocal.c:16:8:16:9 | fread output argument | funcsLocal.c:17:9:17:10 | *i1 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | funcsLocal.c:16:8:16:9 | fread output argument | string read by fread |
@@ -41,3 +78,21 @@ subpaths
4178
| funcsLocal.c:47:9:47:11 | ** ... | funcsLocal.c:46:7:46:9 | gets output argument | funcsLocal.c:47:9:47:11 | ** ... | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | funcsLocal.c:46:7:46:9 | gets output argument | string read by gets |
4279
| funcsLocal.c:53:9:53:11 | ** ... | funcsLocal.c:52:8:52:11 | *call to gets | funcsLocal.c:53:9:53:11 | ** ... | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | funcsLocal.c:52:8:52:11 | *call to gets | string read by gets |
4380
| funcsLocal.c:58:9:58:10 | *e1 | funcsLocal.c:16:8:16:9 | fread output argument | funcsLocal.c:58:9:58:10 | *e1 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | funcsLocal.c:16:8:16:9 | fread output argument | string read by fread |
81+
| funcsLocal.c:110:10:110:12 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:110:10:110:12 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to vprintf(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
82+
| funcsLocal.c:111:13:111:15 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:111:13:111:15 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to _vprintf_l(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
83+
| funcsLocal.c:112:14:112:16 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:112:14:112:16 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to vfprintf(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
84+
| funcsLocal.c:113:17:113:19 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:113:17:113:19 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to _vfprintf_l(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
85+
| funcsLocal.c:114:23:114:25 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:114:23:114:25 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to vsnprintf(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
86+
| funcsLocal.c:115:24:115:26 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:115:24:115:26 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to _vsnprintf(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
87+
| funcsLocal.c:116:26:116:28 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:116:26:116:28 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to _vsnprintf_l(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
88+
| funcsLocal.c:117:31:117:33 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:117:31:117:33 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to vsnprintf_s(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
89+
| funcsLocal.c:118:32:118:34 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:118:32:118:34 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to _vsnprintf_s(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
90+
| funcsLocal.c:119:34:119:36 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:119:34:119:36 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to _vsnprintf_s_l(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
91+
| funcsLocal.c:120:16:120:18 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:120:16:120:18 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to vsprintf(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
92+
| funcsLocal.c:121:19:121:21 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:121:19:121:21 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to _vsprintf_l(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
93+
| funcsLocal.c:122:25:122:27 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:122:25:122:27 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to _vsprintf_p(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
94+
| funcsLocal.c:123:27:123:29 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:123:27:123:29 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to _vsprintf_p_l(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
95+
| funcsLocal.c:124:24:124:26 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:124:24:124:26 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to vsprintf_s(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
96+
| funcsLocal.c:125:27:125:29 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:125:27:125:29 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to _vsprintf_s_l(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
97+
| funcsLocal.c:126:15:126:17 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:126:15:126:17 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to _vscprintf_p(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |
98+
| funcsLocal.c:127:17:127:19 | *fmt | funcsLocal.c:109:8:109:10 | fread output argument | funcsLocal.c:127:17:127:19 | *fmt | The value of this argument may come from $@ and is being used as a formatting argument to _vscprintf_p_l(format). | funcsLocal.c:109:8:109:10 | fread output argument | string read by fread |

0 commit comments

Comments
 (0)